Business Operations, Internal Controls and AML
This topic covers how a licensed firm must run itself so that misconduct is prevented and detected: internal controls under senior-management responsibility, the anti-money-laundering and counter-terrorist-financing regime under the AMLO, and the protection of clients' personal data. Anti-money-laundering carries the most detail and the most questions—customer due diligence, the risk-based approach, and suspicious-transaction reporting are the core.
Internal controls and senior-management responsibility
A licensed firm must maintain proper internal controls. The SFC's Management, Supervision and Internal Control Guidelines, together with GP9 of the Code, place ultimate responsibility for the firm's controls and compliance on its senior management—responsibility cannot be delegated away to a junior compliance officer. Sound controls include clear reporting lines and segregation of duties, effective risk management, compliance monitoring, and independent review or audit. The Managers-In-Charge framework makes this personal by naming the individuals accountable for each Core Function, including compliance and the AML/CFT function.
The AMLO framework and the risk-based approach
The statutory basis of Hong Kong's anti-money-laundering regime for financial institutions is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO), supplemented by the SFC's AML/CFT Guideline. The whole regime is built on a risk-based approach: a firm assesses the money-laundering and terrorist-financing risk of each customer, product and channel, and applies stronger controls where risk is higher and lighter ones where it is demonstrably lower. It is useful to know the three recognised stages of money laundering—placement (getting illicit cash into the system), layering (moving it through transactions to obscure its origin) and integration (bringing it back as apparently legitimate wealth)—because red-flag questions map onto these stages.
Customer due diligence (CDD) under AMLO Schedule 2
Schedule 2 to the AMLO sets out the customer due diligence duties. Before establishing a business relationship the firm must identify the customer and verify their identity using reliable, independent documents or data; where the customer is not a natural person (for example a company), identify the beneficial owners—broadly the individuals who ultimately own or control the customer, with control commonly taken at a 25% ownership threshold—and understand the ownership and control structure; and understand the intended purpose and nature of the relationship. Verification should generally be completed before the relationship is established (limited exceptions allow it to be completed as soon as reasonably practicable afterwards where ML risk is effectively managed). CDD is ongoing, not one-off: the firm must keep information current and scrutinise transactions to ensure they are consistent with what it knows about the customer.
Higher and lower risk: EDD, PEPs, reliance and record-keeping
The risk-based approach flexes CDD. Enhanced due diligence (EDD) applies to higher-risk situations—non-face-to-face onboarding, or a customer who is a politically exposed person (PEP)—and typically requires senior-management approval to establish or continue the relationship, steps to establish the source of wealth and funds, and closer ongoing monitoring. Simplified due diligence may be appropriate only where risk is demonstrably low (for example certain regulated or listed entities). A firm may rely on another qualified intermediary to perform certain CDD measures, but it remains ultimately responsible for compliance. CDD and transaction records must be kept for at least five years after the relationship ends or the transaction is completed—contrast this with the seven-year period under the Keeping of Records Rules. Firms must also appoint a Money Laundering Reporting Officer (MLRO) as the focal point for suspicious-transaction reporting.
Suspicious transactions, tipping off and terrorist financing
Where an employee knows or suspects that property represents the proceeds of crime, or is connected to money laundering or terrorist financing, they must make a suspicious transaction report (STR) to the Joint Financial Intelligence Unit (JFIU). The reporting duty arises from suspicion and is not subject to any minimum monetary threshold. Once a report is made, disclosing to the customer that a report has been (or may be) made—'tipping off'—is a criminal offence, as is failing to report. The underlying money-laundering offences sit in the Organized and Serious Crimes Ordinance (OSCO) and the Drug Trafficking (Recovery of Proceeds) Ordinance; terrorist-financing obligations, including checking against and freezing the assets of designated persons, arise under the United Nations (Anti-Terrorism Measures) Ordinance.
Personal data protection and how the topic is tested
An intermediary's handling of clients' personal data is governed principally by the Personal Data (Privacy) Ordinance (PDPO) and its data-protection principles, which require data to be collected fairly and for a lawful purpose, used only for that purpose (or a directly related one) absent consent, kept accurate and no longer than necessary, secured against loss, and made available to the data subject for access and correction. In the exam, AML supplies the bulk of the questions: expect recall on CDD before onboarding, beneficial-owner identification under Schedule 2, the risk-based approach, PEP/EDD and senior-management approval, the five-year retention period, and the STR-to-JFIU duty with the tipping-off offence. Pair these with GP9/internal-control responsibility resting on senior management, and the PDPO as the source for personal-data handling.
Keep going: the full HKSI LE Paper 1 (Regulation) guide covers every section of the exam. HKSI Licensing Examination Paper 1 — Complete Study Guide (2026) — PDF + EPUB, $19.99 · 14-day refund →
In the HKSI LE Paper 1 (Regulation) guide: A full practice section and a cram sheet at the back, with the reasoning behind every answer. Practice here stays free.